The maker of Kleenex tissue and other products faced a daunting task: Document 4,000 different financial controls. It could have been worse.

When Jerry Rehfuss, a finance director at Kimberly-Clark Co., was asked in July 2003 to head up the company's efforts to comply with the Sarbanes-Oxley Act of 2002, he cringed.

Adhering to the federal law, crafted in response to the manipulation of financial statements at companies such as Enron and WorldCom, would be a massive undertaking for Kimberly-Clark, a $15 billion global company best known as the maker of Kleenex and Scott tissue products and Huggies diapers.

"I am not averse to doing work, but this was one of the biggest pieces of corporate regulation that's come in decades," Rehfuss recalls.
View the PDF -- Turn off pop-up blockers!

Worse, the federal government had not yet fully spelled out what companies needed to do to avoid running afoul of the new law.

Still, Rehfuss took the job, heading up a core team of six employees and another 200 local and regional coordinators. The major thrust involved the law's key provision, known as Section 404; it requires publicly traded companies such as Kimberly-Clark to identify, test and document internal controls to prevent errors or fraudulent activities that affect the accuracy of financial statements. Once internal auditors test a sample of those controls, any problems must be documented and remediated.

Preparing an internal controls report turned out to be a major undertaking because of Kimberly-Clark's size and complexity. With headquarters in Irving, Texas, the company manufactures tissues, toilet paper, diapers and other paper products at locations around the world including Shanghai, China; Klucze, Poland; and Jakarta, Indonesia.

As Rehfuss sums it up, "60,000 employees in 50 countries at 200 locations. Different languages, cultures, time zones, systems."

To pull it off, Kimberly-Clark created what Rehfuss calls a "giant filing cabinet," albeit an electronic one, that can be accessed by 2,000 employees who perform varying activitiesfrom attaching Word or Excel documents that spell out control procedures, audit-test results or action plans to signing off on results. In all, the filing system serves as a repository for tens of thousands of documents and keeps tabs on some 4,000 controls.

Kimberly-Clark has an advantage over many other companies: For more than three decades, the manufacturer has maintained a five-volume document called "Corporate Financial Instructions" that includes more than 1,000 internal control requirements for key processes.

This document served as the starting point for the Sarbanes-Oxley review of processes such as payroll, sales orders, billing, cash disbursement and computer access; it also identifies internal controls such as making sure, in accounts payable, that one employee signs off on the invoices prepared by another employee.

"We started with a playbook of existing controls applicable to every Kimberly-Clark location worldwide," Rehfuss says. "From location to location, country to country, the actual controls might vary. But the basic principlessay, for each transaction, one person needs to prepare it and another person needs to authorize ithave been in place for each process."

Kimberly-Clark retained Ernest & Young as a consultant to determine the measures most likely to have an impact on the accuracy of financial statements. During this phase, which stretched from September to December 2003, the team identified 80 key processes and 370 significant controls, and then asked subject-matter and process experts within Kimberly-Clark whether anything should be added or removed from the exhaustive review.

Then, 200 regional and locator coordinators were asked to determine whether these processes take place at their location, and then identify the employees, or "control owners," responsible for making sure the controls are documented and tested.

At first, Kimberly-Clark executives thought they might have up to 20,000 controls that would have to be documented and tested. Upon closer inspection, that number came down to about 4,000. That's because not every process or control applies to every location. For example, Kimberly-Clark had accounts-receivable and accounts-payable controls listed for its different locations in Europe.

"The reality was that those reside in Brighton [England] at the shared service center." Rehfuss says. "So, the business centers in those countries did not have to document those controls."

At first, most of this information was maintained in what the team called a "control map," an Excel spreadsheet that listed processes applicable to each Kimberly-Clark location, as well as any variations. If, for example, an office in Indonesia used a slightly different accounts-receivable control than another site, that is documented in the spreadsheet as an "alternate" or "compensating" control.
Story Guide:

Executive Editoravirzi@ziffdavisenterprise.comAnna Maria was assistant managing editor Forbes.com. She held the posts of news editor and executive editor at Internet World magazine and was city editor and Washington correspondent for the Connecticut Post, a daily newspaper in Bridgeport. Anna Maria has a B.A. from the University of Rhode Island.